ciagent
b4d9409e4d
Wave A of P03. Wires the three security tools into the
.coreci.yml pipeline and exposes them via a
local make target.
- .gitleaks.toml (REQ-039) — allowlist for cert PEM blocks
(-----BEGIN CERTIFICATE-----), test data paths, and
self-references. Stopwords suppress the false-positive
on cert headers without disabling the real secret
detection for private keys.
- .gitleaks-baseline.json (REQ-029) — suppresses the v0.1
historical .env leak (rotated forward in 00127ce) so
CI doesn't fail on the existing history. The baseline
format matches gitleaks 8.x.
- .golangci.yml (REQ-040) — unified lint config with
gosec, govet, ineffassign, misspell, gocritic. gosec
severity=high so G101 (hardcoded credentials) is a
build-breaker. Excludes _test.go for G404 (math/rand
is fine in tests) and internal/security/testdata/.
- .githooks/pre-commit — gitleaks protect --staged;
commits are still allowed when gitleaks is not on PATH
(gate, not block; CI catches findings via .coreci.yml).
- scripts/security_scan.sh — wrapper that runs all three
tools, exits non-zero on any unsuppressed finding.
Detects missing tools and SKIPs in dev mode (--strict
flips to FAIL on skip). Used by ./scripts/security_scan.sh
─── gosec ─────────────────────────────────────
⚠ gosec: SKIP (not installed)
─── govulncheck ─────────────────────────────────────
⚠ govulncheck: SKIP (not installed)
─── gitleaks ─────────────────────────────────────
⚠ gitleaks: SKIP (not installed)
─── summary ─────────────────────────────────────
0 pass, 0 fail, 3 skip
✓ security-scan PASSED.
- docs/security-scanning.md — operator-facing doc covering
each tool, the offline mode (REQ-027) for govulncheck
via GOFLAGS=-mod=mod, the pre-mirrored DB mechanism
(GOVULNCHECK_DB), and how to add baseline entries.
- .coreci.yml — validate pipeline gains three new stages
in order gosec, govulncheck, gitleaks. Test pipeline
runs with -race (REQ-031). Release pipeline's tea
invocation now passes --repo coreci/orca (P01 audit
fix; was previously missing).
- Makefile — adds test-race and security-scan targets;
help text updated.
- scripts/release.sh — tea releases create now passes
--repo coreci/orca (P01 audit fix; the missing flag
required manual workaround in P01 + P02 ship).
All builds clean; tests pass with -race; gofmt -l . clean;
go vet ./... clean.
---ci---
project: orca
phase: 10
milestone: v0.2
status: execute
---/ci---
42 lines
1.3 KiB
TOML
42 lines
1.3 KiB
TOML
# gitleaks config for orca (v0.2 P03, REQ-039)
|
|
#
|
|
# Allowlist CA cert PEM blocks (-----BEGIN CERTIFICATE-----) and test
|
|
# data paths under internal/security/testdata/. Stopwords for both
|
|
# the v0.1 historical `.env` leak (mitigated forward; baseline file
|
|
# .gitleaks-baseline.json handles the historical case) and the
|
|
# `.gitleaks-baseline.json` file itself.
|
|
|
|
title = "orca gitleaks config"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Global allowlist for orca repo"
|
|
paths = [
|
|
'''\.gitleaks-baseline\.json$''',
|
|
'''\.gitleaks\.toml$''',
|
|
'''\.golangci\.yml$''',
|
|
'''\.coreci\.yml$''',
|
|
'''\.ciagent/.*\.md$''',
|
|
'''CHANGELOG\.md$''',
|
|
'''internal/security/testdata/.*''',
|
|
'''docs/security-scanning\.md$''',
|
|
]
|
|
|
|
# Stopwords for cert PEM blocks (REQ-039): allow the cert headers,
|
|
# but not the private-key headers. We rely on gitleaks' built-in
|
|
# private-key detector for the latter; the allowlist here suppresses
|
|
# the cert-PEM false-positive on `-----BEGIN CERTIFICATE-----`.
|
|
stopwords = [
|
|
'''-----BEGIN CERTIFICATE-----''',
|
|
'''-----END CERTIFICATE-----''',
|
|
]
|
|
|
|
[[rules]]
|
|
id = "orca-cert-pem"
|
|
description = "CA and leaf cert PEM blocks (allowlisted, not flagged)"
|
|
regex = '''-----BEGIN (?:RSA |EC |DSA |)CERTIFICATE-----'''
|
|
keywords = ["-----BEGIN CERTIFICATE-----"]
|
|
allowlist = true
|